Detection of Potential Defense Evasion via Endpoint Telemetry Suppression

This detection logic focuses on identifying potential adversary attempts to impair security monitoring on an endpoint by detecting a lack of expected telemetry following a security alert. When an endpoint security agent generates an alert, the system is expected to continue logging routine activities such as process execution, network connections, file system modifications, and DNS queries. A sudden, complete silence in these event categories within a 10-minute window following an alert often indicates that the security agent has been tampered with, disabled, or that the host system has crashed as a result of malicious interference. This technique is a common defensive evasion strategy used to prevent further monitoring or attribution after an initial intrusion detection. Defenders should prioritize these events to differentiate between malicious tampering and benign operational events such as system reboots, agent upgrades, or network connectivity failures.

Impact

Successful suppression of security telemetry prevents SOC analysts from observing subsequent attacker actions, including lateral movement, credential access, and exfiltration. This leads to extended dwell time, potential loss of forensic visibility, and the possibility of undetected persistent access within the targeted network environment.

Recommendation

• Deploy the detection logic to identify hosts that experience a complete cessation of telemetry following a security alert.
• Establish a baseline of normal agent behavior to minimize false positives associated with legitimate system reboots or agent maintenance.
• Integrate host health monitoring (e.g., agent heartbeat status) with SIEM alerts to correlate telemetry gaps with potential service crashes or unauthorized service terminations.
• Investigate the root cause of the alert immediately preceding the telemetry silence to determine if it aligns with known adversary TTPs or malware execution patterns.